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DETAILED ACTION 

1 . Claims 1-38 are pending in this application. 

2. Claim 1 is amended in the preliminary amendment filed on November 15, 2004. 

3. Claims 4-38 are newly presented in the preliminary amendment filed on 
November 15, 2004. 

Claim Objections 

4. Claims 4, 17, 25 and 26 are objected to for lack of antecedent basis: 
Claim 4 recites "the execution scheduling" in line 3. 

Claim 17 recites "the execution scheduling" in line 3. 

Claim 25 recites "the step of sending an encryption key" in line 1 . 

Appropriate correction and/or clarification required. 



Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 1-2, 8-13 and 21-24 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Douglas (Patent No.: US 7,152,242 B2) and further in view of O'Neal 



et al. (Patent No.: US 6,640,242 B1), hereinafter "O'Neal". 
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7. As to claim 1 , a computer system, Douglas discloses comprising: a hard real- 
time operating system (abstract, "...monitors system logs for evidence of malicious or 
suspicious application activity running in real time.."); an application running under the 
hard real-time operating system (column 2, lines 30-50, "...the HIDS sensor 20 also 
monitors the logs of applications running..."); and a security process running under the 
hard real-time operating system (column 9, lines 3-15, "The HIDS sensor 20 is capable 
of monitoring the integrity of the Linux kernel"), wherein the security process is 
configured to periodically, in hard real-time, check the integrity of the application and/or 
a data element used by the application (column 9, lines 3-15, "The HIDS sensor 20 is 
capable of monitoring the integrity of the Linux kernel", see also column 4, lines 44-60) 
and, if the integrity check of the application or the data element indicates that the 
application or data element has been tampered with, notify a user of the computer 
system and/or shut down at least part of the computer system or application (column 2, 
lines 45-60, "The HIDS sensor 20 detects this activity via it's file integrity checking 
capabilities and, notifying an IDS administrator when key system and security file have 
been accessed, modified .."). 

Douglas doesn't explicitly disclose the security process includes a challenge 
handler that is configured to receive a challenge from an external monitor and provide a 
response thereto within a predetermined amount of time, wherein the external monitor is 
configured so that if the external monitor does not receive the response within a 
predetermined amount of time from sending the challenge, the external monitor notifies 
an administrator and/or shuts down at least part of the computer system or application. 
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However, O'Neal discloses the security process includes a challenge handler that is 
configured to receive a challenge from an external monitor and provide a response 
thereto within a predetermined amount of time, wherein the external monitor is 
configured so that if the external monitor does not receive the response within a 
predetermined amount of time from sending the challenge, the external monitor notifies 
an administrator and/or shuts down at least part of the computer system or application 
(column 19, lines 10-25, "If a system or sub-system fails to respond within a 
predetermined amount of time, monitor 216 alerts a system administrator.."). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas as taught by O'Neal 
in order to protect resources and to ensure safe and secure operations. 

8. As to claim 2, Douglas discloses in a computer system running a real-time 
operating system (abstract, "...monitors system logs for evidence of malicious or 
suspicious application activity running in real time.."), a computer security method, 
comprising: executing a security process under the real-time operating system (column 

9, lines 3-15, "The HIDS sensor 20 is capable of monitoring the integrity of the Linux 
kernel"), wherein the security process is configured to periodically, in hard real-time, 
check the integrity of an application and/or a data element used by the application 
(column 9, lines 3-15, "The HIDS sensor 20 is capable of monitoring the integrity of the 
Linux kernel", see also column 4, lines 44-60) and notify a system administrator and/or 
shut down the application if the integrity check of the application or the data element 
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indicates that the application or data element has been tampered with (column 2, lines 
45-60, "The HIDS sensor 20 detects this activity via it's file integrity checking 
capabilities and, notifying an IDS administrator when key system and security file have 
been accessed, modified .."). 

Douglas doesn't explicitly disclose sending a challenge to the security process or 
to a challenge handler that monitors the integrity of the security process; and notifying 
an administrator if a response to the challenge is not received within a predetermined 
amount of time. However, O'Neal discloses sending a challenge to the security process 
or to a challenge handler that monitors the integrity of the security process; and 
notifying an administrator if a response to the challenge is not received within a 
predetermined amount of time (column 19, lines 10-25, "If a system or sub-system fails 
to respond within a predetermined amount of time, monitor 216 alerts a system 
administrator.."). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas as taught by O'Neal 
in order to protect resources and to ensure safe and secure operations. 

9. As to claim 21 , Douglas doesn't explicitly disclose wherein the challenge is sent 
from an external monitor. However, O'Neal discloses wherein the challenge is sent from 
an external monitor (column 19, lines 10-20). 
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Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Douglas as taught by O'Neal in 
order to protect resources and to ensure safe and secure operations. 

1 0. As to claims 8 and 22, Douglas doesn't explicitly disclose wherein the external 
monitor is an application running on a second computer system that is connected to the 
first computer system. However, O'Neal discloses wherein the external monitor is an 
application running on a second computer system that is connected to the first computer 
system (column 19, lines 10-20). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Douglas as taught by O'Neal in 
order to protect resources and to ensure safe and secure operations. 

11. As to claim 9, 10 and 23, Douglas doesn't explicitly disclose wherein the second 
computer system is connected to the first computer system by a network. However, 
O'Neal discloses wherein the second computer system is connected to the first 
computer system by a network (column 19, lines 1-20). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Douglas as taught by O'Neal in 
order to protect resources and to ensure safe and secure operations. 
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12. As to claims 11,12 and 13, Douglas doesn't explicitly disclose wherein the 
external monitor includes a device of the computer system. However, O'Neal discloses 
wherein the external monitor includes a device of the computer system (column 19-1- 
20). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Douglas as taught by O'Neal in 
order to protect resources and to ensure safe and secure operations. 

1 3. As to claim 24, Douglas doesn't explicitly disclose further comprising the steps of 
receiving the challenge and transmitting the response in response to receiving the 
challenge. However, O'Neal discloses the steps of receiving the challenge and 
transmitting the response in response to receiving the challenge (column 19, lines 10- 
20). 

Therefore, it would have been obvious to one of ordinary skill in the art the time 
of the invention was made to modify the teaching of Douglas as taught by O'Neal in 
order to protect resources and to ensure safe and secure operations. 

14. Claims 3, 27 and 31 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over REDSonic, Inc, " http://www.redsonic.com/en/products/RealTime.htm ": Copyright 
2002, pp 1-4, hereinafter "Sonic" and further in view of Douglas. 
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15. As to claim 3, Sonic discloses a computer system, comprising: a dual-kernel 
operating system comprising a real-time kernel (page 1, Sonic teaches this concept by 
disclosing the real-time kernel which inserts a thin layer between the interrupt-control 
hardware and the standard Linux kernel) and a non-real-time kernel ("Linux Kernel" - 
e.g. page 1); a first real-time thread running under the real-time kernel (page 1 , Sonic 
teaches this concept by disclosing "real-time Linux kernel as a small real-time OS that 
can suspend Linux's execution at any state"), the first real-time thread being configured 
to monitor an application running under the non-real-time kernel (page 1 , Sonic teaches 
this concept by disclosing the real-time kernel which inserts a thin layer between the 
interrupt-control hardware and the standard Linux kernel); 

Sonic doesn't explicitly disclose the thread being monitor the integrity; a second 
real-time thread running under the real-time kernel, the second real-time thread being 
configured to monitor integrity of the first real-time thread; and a security process 
running under the non-real-time kernel, the security process being configured to-check 
the integrity of the first real-time thread and/or the second real-time thread. 

However, Douglas discloses the thread being monitor the integrity (column 2, 
lines 45-50, "...integrity checking feature"); a second real-time thread running under the 
real-time kernel (column 2, lines 35-60, which describes file integrity checking feature 
for an additional level of detection"), the second real-time thread being configured to 
monitor integrity of the first real-time thread (column 2, lines 30-60, "...monitor system 
files via its file integrity checking feature for an additional level of detection and 
protection"); and a security process running under the non-real-time kernel, the security 
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process being configured to-check the integrity of the first real-time thread and/or the 
second real-time thread (column 9, lines 3-15, "The HIDS sensor 20 is capable of 
monitoring the integrity of the Linux kernel", see also column 4, lines 44-60). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic as taught by Douglas in 
order to "provide notification of the intrusion or intrusion attempts." (Douglas) 

16. As to claim 27, Sonic doesn't explicitly disclose wherein the first real-time thread 
is further configured to check a set of integrity markers of the non-real-time kernel. 
However, Douglas discloses wherein the first real-time thread is further configured to 
check a set of integrity markers of the non-real-time kernel (column 2, lines 45-50, 
"...integrity checking feature"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic as taught by Douglas in 
order to "provide notification of the intrusion or intrusion attempts." 

17. As to claim 31 , Sonic doesn't explicitly disclose wherein the second real-time 
thread is further configured to check a set of integrity markers of the real-time kernel. 
However, Douglas discloses wherein the second real-time thread is further configured 
to check a set of integrity markers of the real-time kernel (column 2, lines 45-50). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic as taught by Douglas in 
order to "provide notification of the intrusion or intrusion attempts." 

18. Claims 4-5 and 17-18 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Douglas and further in view of O'Neal and Williams et al. (Patent No.: 5,91 1 ,065), 
hereinafter "Williams". 

19. As to claims 4 and 17, neither Douglas nor O'Neal explicitly discloses wherein 
the integrity check performed by the security process includes checking the execution 
scheduling of the application. However, Williams discloses wherein the integrity check 
performed by the security process includes checking the execution scheduling of the 
application (abstract, column 4, lines 39-45 and column 6, lines 30-40). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Douglas and O'Neal as taught by 
Williams in order to ensuring that the time sequence for the delivery of interrupts is not 
altered. 

20. As to claims 5 and 18, neither Douglas nor O'Neal explicitly discloses wherein 
the security process is configured to raise an alarm if, after checking the execution 
scheduling of the application, the security process determines that the application is not 
being scheduled at a required minimum frequency. However, Williams discloses 
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wherein the security process is configured to raise an alarm if, after checking the 
execution scheduling of the application, the security process determines that the 
application is not being scheduled at a required minimum frequency (abstract, column 4, 
lines 39-45 and column 6, lines 30-40). 

Therefore it would have been obvious to one of ordinary skill in the art at the time 
of the invention was made to modify the teaching of Douglas and O'Neal as taught by 
Williams in order to ensuring that the time sequence for the delivery of interrupts is not 
altered. 

21. Claims 6-7, 14 and 19-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Douglas and further in view of O'Neal and Terry (Pub. No.: US 
2002/0026505 A1). 

22. As to claims 6 and 19, neither Douglas nor O'Neal explicitly disclose wherein the 
integrity check performed by the security process includes checking the integrity of the 
application's code. However, Terry discloses wherein the integrity check performed by 
the security process includes checking the integrity of the application's code ([0074]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas and O'Neal as taught 
by Terry in order to report any modifications to management personnel within a 
business or organization. 
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23. As to claims 7 and 20, neither Douglas nor O'Neal discloses wherein the security 
process is configured to raise an alarm if, after checking the integrity of the application's 
code, the security process determines that the application code has been tampered 
with. However, Terry discloses wherein the security process is configured to raise an 
alarm if, after checking the integrity of the application's code, the security process 
determines that the application code has been tampered with ([0074], "...reports (alerts) 
the administrative application"). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas and O'Neal as taught 
by Terry in order to report any modifications to management personnel within a 
business or organization. 

24. As to claim 14, neither Douglas nor O'Neal explicitly discloses wherein the 
security process is further configured to update a data item with a sequence number 
indicating a number of cycles that have passed without detection of an intruder. 
However, Terry discloses wherein the security process is further configured to update a 
data item with a sequence number indicating a number of cycles that have passed 
without detection of an intruder ([0058] - [0059]). 

Therefore, it would have been obvious to one of ordinary skill in the art the time 
of the invention was made to modify the teaching of Douglas and O'Neal as taught by 
Terry in order to report any modifications to management personnel within a business or 
organization. 
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25. Claims 25 and 26 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Douglas and further in view of O'Neal and Berg et al. (Pub. No.: US 2001/0044904 
A1), hereinafter "Berg". 

26. As to claim 25, neither Douglas nor O'Neal explicitly disclose further comprising 
the step of sending an encryption key to the security process at or about the same time 
as sending the challenge to the security process. However, Berg discloses the step of 
sending an encryption key to the security process at or about the same time as sending 
the challenge to the security process ([0071]-[0072]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas and O'Neal as taught 
by Berg in order to ensure the confidentiality of sensitive information. 

27. As to claim 26, neither Douglas nor O'Neal explicitly discloses further comprising 
the steps of receiving the encryption key and encrypting the response using the 
encryption key prior to transmitting the response. However, Berg discloses further 
comprising the steps of receiving the encryption key and encrypting the response using 
the encryption key prior to transmitting the response ([0007], [0027], lines 16-24 and 
[0072]). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas and O'Neal as taught 
by Berg in order to ensure the confidentiality of sensitive information. 

28. Claims 28-30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Sonic and further in view of Douglas and Berg. 

29. As to claim 28, neither Sonic nor Douglas explicitly discloses wherein the 
integrity markers include a checksum and/or digital signature of a data element that 
maintains information about a password file used by the non-real-time kernel. However, 
Berg discloses wherein the integrity markers include a checksum and/or digital 
signature of a data element that maintains information about a password file used by 
the non-real-time kernel ([0027], lines 16-24 and [0072]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by Berg in order to ensure the confidentiality of sensitive information. 

30. As to claim 29, neither Sonic nor Douglas explicitly discloses wherein the data 
element is an inode. However, Berg discloses wherein the data element is an inode 
([0072]). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by Berg in order to ensure the confidentiality of sensitive information. 

31 . As to claim 30, neither Sonic nor Douglas explicitly discloses wherein the 
application is programmed to encrypt and decrypt passwords stored in the password 
file. However, Berg discloses wherein the application is programmed to encrypt and 
decrypt passwords stored in the password file ([0027], lines 16-24 and [0072]). 

Therefore, it^ould have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by Berg in order to ensure the confidentiality of sensitive information. 

32. Claims 32-35 and 37-38 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Sonic and further in view of Douglas and O'Neal. 

33. As to claim 32, Sonic discloses the real-time kernel (page 1). Neither Sonic nor 
Douglas explicitly discloses a challenge handler executing under the real-time kernel. 
However, O'Neal discloses a challenge handler executing under the real-time kernel 
(column 19, lines 10-20). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
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by O'Neal in order to in order to protect resources and to ensure safe and secure 
operations. 

34. As to claim 33, Sonic doesn't explicitly disclose comprising an external monitor. 
However, Douglas discloses an external monitor (column 2, lines 35-60 and column 9, 
lines 2-10). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic by including an external 
monitor as taught by Douglas in order to "provide notification of the intrusion or intrusion 
attempts." (Douglas) 

35. As to claim 34, neither Sonic nor Douglas explicitly discloses wherein the 
challenge handler is responsive to challenges sent from the external monitor to the 
challenge handler. However, O'Neal discloses wherein the challenge handler is 
responsive to challenges sent from the external monitor to the challenge handler 
(column 19, lines 10-20). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by O'Neal in order to in order to protect resources and to ensure safe and secure 
operations. 
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36. As to claim 35, neither Sonic nor Douglas explicitly discloses wherein the 
challenge handler is configured to send a response to the external monitor in response 
to receiving from the external monitor a challenge. However, O'Neal discloses wherein 
the challenge handler is configured to send a response to the external monitor in 
response to receiving from the external monitor a challenge (column 19, lines 10-20). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by O'Neal in order to in order to protect resources and to ensure safe and secure 
operations. 

37. As to claim 37, neither Sonic nor Douglas explicitly discloses wherein the 
external monitor is programmed to determine whether the response from the challenge 
handler was received by the external monitor within a predetermined amount of time. 
However, O'Neal discloses wherein the external monitor is programmed to determine 
whether the response from the challenge handler was received by the external monitor 
within a predetermined amount of time (column 19, lines 10-20). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by O'Neal in order to in order to protect resources and to ensure safe and secure 
operations. 
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38. As to claim 38, neither Sonic nor Douglas discloses wherein the external monitor 
is further programmed to raise an alarm if it determines that the response from the 
challenge handler was not received by the external monitor within the predetermined 
amount of time. However, O'Neal discloses wherein the external monitor is further 
programmed to raise an alarm if it determines that the response from the challenge 
handler was not received by the external monitor within the predetermined amount of 
time (column 19, lines 10-20). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic and Douglas as taught 
by O'Neal in order to in order to protect resources and to ensure safe and secure 
operations. 

39. Claims 15 and 16 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Douglas and further in view of O'Neal, Terry and Berg. 

40. As to claim 1 5, neither Douglas and O'Neal nor Terry explicitly discloses wherein 
the security process is further configured to transmit the data item to the external 
monitor using an encryption key included in a challenge sent to the challenge handler. 
However, Berg discloses wherein the security process is further configured to transmit 
the data item to the external monitor using an encryption key included in a challenge 
sent to the challenge handler ([0007], [0027], lines 16-24 and [0072]). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas, O'Neal and Terry as 
taught by Berg in order to ensure the confidentiality of sensitive information. 

41 . As to claim 16, Douglas doesn't explicitly disclose wherein the security process is 
further configured to transmit the data item to the external monitor within a 
predetermined amount of time from when the external monitor sent a challenge to the 
challenge handler. However, O'Neal discloses wherein the security process is further 
configured to transmit the data item to the external monitor within a predetermined 
amount of time from when the external monitor sent a challenge to the challenge 
handler (column 19, lines 10-20). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Douglas as taught by O'Neal 
in order to protect resources and to ensure safe and secure operations. 

42. Claim 36 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sonic 
and further in view of Douglas, O'Neal and Berg. 

43. As to claim 36, neither Sonic and Douglas nor O'Neal explicitly disclose wherein 
the response includes an encrypted data item. However, Berg discloses wherein the 
response includes an encrypted data item ([0007], which describes encrypting and 
decrypting communications). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify the teaching of Sonic, Douglas and O'Neal as 
taught by Berg in order to increase the security of transferred data. 



44. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Suman Debnath whose telephone number is 571 270 
1256. The examiner can normally be reached on 8 am to 5 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on 571 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Conclusion 
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